<?php

    class Model_UserAcl extends Zend_Acl {

        /**
         * beinhaltet alle Rollen deren Vergabe nur ausgewaehlten benutzern vorbehalten ist
         *
         * @var array
         */
        public $protectedRoles = array();

        /**
         * stellt beziehung zwischen modul und Benutzer her
         *
         * @var array
         */
        public $modulePrefix = array('frontend' => 'fe_',
                                     'backend'  => 'be_');

        public function __construct() {
            /******************** Benutzergruppen **********************/

            // muessen mit den Benutzergruppen aus Benutzertabelle uebereinstimmen
            // (TODO) HINWEIS:
            // jede rolle beinhaltet auch die Umgebung in dem sie vergeben werden kann (Backend be_ ; frontend fe_ ...)
            // diese zuordnung wird in der variablen $modulePrefix verwaltet
            $this->addRole(new Zend_Acl_Role($this->modulePrefix['frontend'].'users'));

            $this->addRole(new Zend_Acl_Role($this->modulePrefix['backend'].'users'));
            $this->addRole(new Zend_Acl_Role($this->modulePrefix['backend'].'admins'), $this->modulePrefix['backend'].'users');
            $this->addRole(new Zend_Acl_Role($this->modulePrefix['backend'].'oncut'),  $this->modulePrefix['backend'].'admins');

            //(TODO) HINWEIS:
            //alle rollen hinzufuegen, die nur von bestimmten benutzern vergeben werden duerfen (z.B. be_oncut rolle darf wird be_oncut Benutzern vergeben
            $this->protectedRoles[] = $this->modulePrefix['backend'].'oncut';

            /******************** Benutzergruppen - Ende**********************/


            /******************** Ressourcen ***************************/

            //                                       Modulname:Controllername
            $this->addResource(new Zend_Acl_Resource('default'));
            $this->addResource(new Zend_Acl_Resource('default:ajax'),        'default');
            $this->addResource(new Zend_Acl_Resource('default:cut'),         'default');
            $this->addResource(new Zend_Acl_Resource('default:error'),       'default');
            $this->addResource(new Zend_Acl_Resource('default:footer'),      'default');
            $this->addResource(new Zend_Acl_Resource('default:index'),       'default');
            $this->addResource(new Zend_Acl_Resource('default:staticpages'), 'default');
            $this->addResource(new Zend_Acl_Resource('default:videoengine'), 'default');
            $this->addResource(new Zend_Acl_Resource('default:images'),      'default');
            $this->addResource(new Zend_Acl_Resource('default:user'),        'default');


            $this->addResource(new Zend_Acl_Resource('backend'));
            $this->addResource(new Zend_Acl_Resource('backend:authentication'), 'backend');
            $this->addResource(new Zend_Acl_Resource('backend:video-cat'),       'backend');
            $this->addResource(new Zend_Acl_Resource('backend:video'),          'backend');
            $this->addResource(new Zend_Acl_Resource('backend:company'),        'backend');
            $this->addResource(new Zend_Acl_Resource('backend:department'),     'backend');
            $this->addResource(new Zend_Acl_Resource('backend:index'),          'backend');
            $this->addResource(new Zend_Acl_Resource('backend:user'),           'backend');
            $this->addResource(new Zend_Acl_Resource('backend:image'),          'backend');
            $this->addResource(new Zend_Acl_Resource('backend:offer'),          'backend');

            /******************** Ressourcen - Ende***************************/


            /********************* Privilege ********************************/

            //oncut frontend

            //   Erlaube Benutzer im Controller  auf  action zuzugreifen
            //           Benutzer   modul:controller  action
            $this->allow(null, 'default:user',        array('login', 'index', 'export'));
            $this->allow(null, 'default:ajax',        array('getvideolist'));
            $this->allow(null, 'default:cut',         array('index', 'player'));
            $this->allow(null, 'default:error',       array('error'));
            $this->allow(null, 'default:footer',      array('contact', 'agb', 'about', 'imprint'));
            $this->allow(null, 'default:index',       array('index', 'company'));
            $this->allow(null, 'default:staticpages', array('help'));
            $this->allow(null, 'default:videoengine', array('framepic', 'receiveplaylist', 'getplaylist', 'saveprojectlist'));
            $this->allow(null, 'default:images',      array('index', 'navigation', 'detail'));
            $this->allow(null, 'default:ajax',        array('setfavvideo'));

            $this->allow($this->modulePrefix['frontend'].'users', 'default:user', array('logout', 'myprojects', 'edit'));

            //oncut backend
            $this->allow(null, 'backend:authentication', array('login'));

            $this->allow($this->modulePrefix['backend'].'users', 'backend:authentication', array('logout'));
            $this->allow($this->modulePrefix['backend'].'users', 'backend:user', array('edit-my-password'));

            $this->allow($this->modulePrefix['backend'].'admins', 'backend:index',      array('index'));
            $this->allow($this->modulePrefix['backend'].'admins', 'backend:user',       array('index', 'add', 'edit', 'edit-password', 'delete', 'lock'));
            $this->allow($this->modulePrefix['backend'].'admins', 'backend:video',      array('add', 'edit'));
            $this->allow($this->modulePrefix['backend'].'admins', 'backend:image',      array('index', 'add', 'edit', 'delete', 'lock'));
            $this->allow($this->modulePrefix['backend'].'admins', 'backend:company',    array('my-company-index', 'my-company-edit'));
            $this->allow($this->modulePrefix['backend'].'admins', 'backend:department', array('index', 'add', 'edit', 'delete'));
            $this->allow($this->modulePrefix['backend'].'admins', 'backend:video-cat',  array('add', 'edit'));

            $this->allow($this->modulePrefix['backend'].'admins', 'backend:offer', array('index', 'add', 'edit', 'delete', 'lock', 'upload'));

            //company select ist keine Action - dieses privileg bezieht sich nur auf ein formular
            $this->allow($this->modulePrefix['backend'].'oncut', 'backend:user', array('company-select'));
            //oncut-role ist keine Action - dieses privileg bezieht sich nur auf die Rolle be_oncut
            $this->allow($this->modulePrefix['backend'].'oncut', 'backend:user', array('protectedRoles'));

            /********************* Privilege - Ende ********************************/
        }

    }


